WTF, MS?

Frankly, that could probably be the tagline to this blog, but hey. Having had a run-in with a couple of trojans last night, I left the computer on overnight running a full scan, and by this afternoon it was showing the antimalware software running at 25% CPU pretty much constantly. Time for a clean reboot. On checking task manager following boot, I saw an Edge process kick off automatically, with nothing running. A bit of Googling led to this post on Windows Central which shows the bad effect Chrome has on everyone else - it used to be that only Chrome pre-loaded trash into memory (which was why, when I installed it many moons ago to test, it doubled my laptop's boot time) but now everyone's doing it, presumably because everyone's using Chromium as a base. The fix is to use group policies to stop it - Computer Configuration > Administrative Templates > Windows Components > Microsoft Edge and disable "Allow Microsoft Edge to pre-launch at Windows startup" and "Allow ME to start and load the Start and New Tab page at Windows startup". Also stops it when Windows is idle. (Nothing bugs me quite so much as the computer suddenly storming into life when it should be sitting there quietly, twiddling its silicon thumbs.)

New, yet old

 Left my machine running during tea, because I had a metric fucktonne* of work open - apps and various file explorer windows - and wanted to come back to it.

Came back, the machine was off. Nothing - repeat, nothing - in the event logs. No power cut either, everything else in the house running fine. Windows update (always a bastard) had not run.

Disturbed, I had a root around to find that the last file before it died was telemetry - specifically, Microsoft Office Click-to-run. Programs and Features is now showing Office with an install date of today.

A bit of Googling reveals the following:

https://social.technet.microsoft.com/Forums/en-US/cd971c47-bb24-49bc-9b53-6ec1cbdc9870/windows-update-no-office-2016-updates?forum=win10itprosecurity

i.e. if you have any Click-to-run version of Office installed, then updates are controlled within the applications, independent of Windows Update on the machine. 

I have no idea whether the update-and-shutdown-and-screw-your-workflow was by design, or if something failed, but updates are now disabled on this computer. I'll decide when to run them, thanks very much.

---

* 1.61x an imperial fuckton.

What a festering pile of SPP

 Ah, Microsoft devs. What on earth is the point of you? I'm always amazed when I do a Google search for an issue - any issue really - and find it's been a problem for years, through many iterations of the Windows OS and that dozens, if not hundreds, of fee-paying users continue to experience issues and Microsoft continues to do sweet FA, other than laugh all the way to the bank - while Bill Gates gets universal acclaim for saving humanity with the small change that one of his cleaning staff found down the back of just one of his many sofas.

I digress. This blog is pretty moribund, partly because I'm retraining to get the hell out of IT (because I looked at Linux, and at the online Linux communities, and decided I'd rather try my luck elsewhere). But it's here, so I may as well still use it for this one, which is peculiar. 

Software Protection Platform - this service handles licensing within Windows, for those apps and services which are registered with it. So it will be kicked off by Windows itself on login, plus Office, Windows Update, Windows Defender, and various remote access calls. I started poking it because, while it appears to be working on my system, it was making a lot of random calls and kept rescheduling itself for 2122. (There's no reason for this, other than bad coding - something about there being a 100-year default if an end-point isn't properly specified.) But a number of people are having major issues with it, and have been since at least Windows 8 - and the issues are still occurring in Windows 11. This can be the service failing to start, taking ages to start (during which time the system hangs) or the service randomly restarting and closing down apps, and sometimes computers, in the process. Tumbleweed from Microsoft, obvs.

SPP is a weird one because there are 3 tasks in the scheduler relating to it, and it will work fine if you disable 2 of them and leave the main SvcRestartTask running. The service itself is set to Automatic start and the only options are on or off - you can't set it to Manual even with PowerShell. If the service is running, any call to it will kick off reporting to Event Viewer, and the last thing it does is reconfigure the SvcRestartTask for 100 years in the future. If you disable the service, Windows will not be able to guarantee the licensing and things will break. If you leave the service enabled but disable SvcRestartTask - or even change its parameters - then licensing will work absolutely fine, but the SPP service will bitch every 30s to Event Log that the the task can't be rescheduled. So I can only assume there's something hardcoded into the service itself to do with that, as I can't find another task or service that would cause it. 

For anyone for whom this is causing actual problems, the only fix seems to be to work out (with the help of, say, PSTools) what exactly is causing the SPP service to kick off; if you're sitting there minding your own business and suddenly the system hangs or your app closes due to this, then something is calling SPP to trigger it (on servers this often seems to be remote management programs, and on desktops Windows Update seems to be the culprit). WU certainly can be disabled without issue, and only enabled when it's convenient to actually have it hog your bandwidth and system resources downloading fixes for things which Microsoft couldn't be bothered to code correctly in the first place. 

Not actually a computer thing but...

...Apple really, really don't want you using two phones with the same Apple ID. Not sure why. Are there really that many people selling on iphones without wiping them first, that this is a security consideration?

TL;DW - you can do it, but expect Apple to lock the account, screw up iMessage and ask both phones if it's ok if the other can do something every time you change functionality. It might just be easier to create a new ID for the new phone.

DHCP and Powershell

Powershell. Like all coding, it kinda makes sense when you can work through a command, although the chances of ever remembering the correct syntax whilst in the fray of a system meltdown seems remote. Like any foreign language, I suppose it's fine so long as you're in a situation of total immersion. For the rest of us, it's a phrase book all the way.

This morning's fun: trying to extract MAC addresses from a DHCP database so they can be set as reservations. I've done this before with Netsh but the details escape me. And I have that nagging feeling that I ought to be using Powershell, so...

To export leases:

Get-DHCPServerv4Lease -Computer <name> -ScopeID x.x.x.0 | Export-Csv <filename>

For "name" it really is just the name, no \\ required.

Importing can either be done on an individual basis in the console window, or via a .csv file.

The interactive command is

Add-DHCPServerv4Reservation -ScopeID x.x.x.0 -IPAddress x.x.x.x -ClientID "<MAC address>" -Description "<description>"

Note, the MAC address is the hyphenated version.

To do this via .csv, you need the headings "ScopeID", "IPAdress", "Name", "ClientID" and "Description" (typically of Microsoft, these are different names, and in a different order, from those in the export file - this may not be essential, but who knows?)

When you enter the MAC addresses and descriptions, you need the hyphenated address but no quotes.

Powershell command to import from a file:

Import-CSV -Path "<path>" | Add-DHCPServerv4Reservation -ComputerName "<fqdn>"

No, don't ask me why you can export from the NetBIOS name but you need the FQDN to import. It may be moot unless you have an enterprise setup, but I don't feel like testing it on a live server.

Hat-tip to Expert in the Cloud and Microsoft's own docmentation.

Office

More fighting with Office on the new install, but I found something useful. I knew the default Ctrl-V paste had been set to "keep formatting" - this is also the first option if you right-click to paste from the menu - but I didn't realise you could change the default. File > Options > Advanced > Cut, Copy and Paste section. Options are Keep Source Formatting, Merge, or Keep Text. 

It's been a while - but Windows 10 is still pants

Remember what I said about Windows 10 oh, about 5 years ago now? Nothing has happened to changed my mind. On the contrary. Now I'm forced into both supporting it and running it on my own computers, my cordial dislike has hardened to outright loathing, accompanied by a strong desire to punch the relevant developers in the throat. Remember, kids - coding without due care and attention is bad for your health.

I've been having particular issues lately, for no obvious reason, with activating VLK versions of Windows. Put in the correct key during install, the build decides it has another key (where the hell did it get that from?) which it can't activate because "the organisation's activation server isn't available". Don't ask me how it's managed to install a KMS version of Windows when I downloaded the ISO for the VLK version and put the volume licence key in. And this is confirmed by the fact that it will activate to the VLK, but only programmatically:

 From an elevated command prompt:

slmgr.vbs -ipk <product key> [this changes the installed key]

slmgr.vbs -ato [this does the activation]

Hat-tip to Carey Frisch MVP.

Outlook vs Sharepoint

A little thing, but an annoying one.  Both Outlook and Sharepoint cache used e-mail addresses, even when you've entered the address incorrectly; these then appear as auto-complete options on new e-mails.  To delete incorrect or unwanted entries from the auto-complete list:

In Outlook:
Open a new e-mail.
Start typing an address.  An auto-complete list will appear.
Use keyboard arrows or mouse to highlight the offending entry.
Click the X at the right-hand side of the entry to delete.

In Sharepoint:
Similar procedure, except that you cannot use the mouse, or the process fails.
Open a new e-mail.
Start typing an address.  An auto-complete list will appear.
Use the keyboard arrows to highlight the offending entry.
Use the Delete key to delete the entry.

Blogger tweaks

This is an interesting one.  By default, Google wants you to use posts on a single blog page, with the option for extra static pages for reference information.

You can use the Page widget in the Layout to create a page using the link of a label search.  This will give what appears to be a page of blog posts on a related topic, but is actually an archive.  Those posts will also show up on the home page.  (Going to the page will give a status message of "you are viewing all the posts with label X" but there's a way to get rid of that.)

To get themed posts to show on a "static" page without showing on the home page as well is more tricky.  There are several ways to do it if you don't want anything on your homepage at all, or want the homepage to be a single, static post (including using custom 404s or page redirects).  To show both - i.e. to have a "normal" blog on the homepage, with "extra" themed posts on their own pages - is non-standard, not how Google wants it to work, and thus requires changes to the HTML of the template, plus JavaScript. I found a nice little tutorial on how to do this, plus how to hide the identifying label from the label widget.  One thing that isn't mentioned in the tutorial is that it doesn't just hide the labelled post: it also hides anything posted the same day (I don't know enough about JavaScript or Blogger to be able to say why).  For the lack of hassle, I'm prepared to just put a different date on a post when using the specific label.

Outlook revisited

It never improves.

Today, I foolishly decided to correct my Outlook configuration.  You can have any number of .pst files associated with an account, but Outlook will keep its main outlook.ost file for holding the calendar, notes, tasks, journal, contacts and the rest of it.  When you set it up for the first time, it will gleefully pounce on the first e-mail address (and associated .pst file) that you add as the default, and that cannot be easily changed.

Not too much of a problem if you only have one account and it's an Exchange account; more of a problem if you have a bunch of accounts, of varying types, on more than one server.

Oh, and Outlook won't let you use the .pst file associated with an IMAP account as your default Outlook delivery location (I think because an IMAP account is e-mail only, and doesn't have all the other bits).  If you have a secondary Exchange e-mail account it will grab that, which is no good if it's not your primary account (or if, as in my case, it's in someone else's organisation - I need to be able to see it and send from it, but I don't want to be sending from it by default, and I certainly don't want my own org Outlook details mixing with those of the client org.)

If you get caught like this, first things first - go into Accounts and remove everything.  E-mail addresses need to go before their respective data files.  IMAP data files will be recreated, so there's actually no real point keeping them, unless you want to check that everything has synchronised correctly.  The default e-mail has to be removed last, and you may have to close Outlook and go into Control Panel > Mail > Profiles and do it there.

[Aside: if you have moved your Windows profile, say to another drive, you will have Outlook files in both places.  The default outlook.ost file will go in <new drive>\<profile>\Documents\Outlook Files, but all the mail .pst files will go in <old drive>\<profile>\AppData\Local\Microsoft\Outlook]

Go into the above locations and delete (or move to a subfolder if you're feeling fragile) all the .pst and .ost files, with the exception of the outlook.ost.  NB: if you have POP3 data files, back them up first, unless you know you've a copy of emails on the server!

If you have no non-Exchange main org e-mail, create a new base account - I used an admin account.  Open Outlook and configure this account for POP3.  Outlook will then configure this as the default, meaning all the contacts, calendar etc will be within your organisation, associated with an e-mail address you control.

Add back the IMAP accounts.  Outlook will create new data files for them and synchronise - there seems to be no way of changing the location to pick up the old versions.  (Sort of makes sense given that the local versions of these are more of a cache than an actual mailbox - the live mailbox lives on your mail server.)  When they're all in place, you can pick up the saved data files from the subfolder one at a time, and make sure synchronisation has run OK and that you have all the mail.  (If they're POP3 data files, this may be the only copy of these mails you have, depending on the server.)  Once done, the old files can be deleted or (certainly in the case of POP3) kept as a backup.

Lastly, add in any non-organisation IMAP accounts.  Name them such that they group.  Add in any non-org calendars.  (Will need a separate post on that because I can't remember how I did it!)